Many businesses and enterprises have a pressing need to accurately and effectively monitor usage of computer resources. These entities may need to assess their employee's efficiency, determine usage for assessing licensing costs, enforce quotas, etc. One method to monitor usage is through an event log. An event log can be a record of the operations that occur on the system over a period of time (e.g., a local file updated with each read/write/create/delete operation, a remote database with entries reflecting each event, etc.).
Unfortunately, an event log may not always be an accurate record of the events occurring over a period of time. This failure may result for many different reasons, e.g.: an event was not written to the log, perhaps due to a software or hardware failure; an event was deleted from the log after it was written, perhaps due to a file system or network error; an event was corrupted while (or after) being logged; etc. Regardless of the reason for the missing or corrupted event, such an occurrence can make it difficult to understand how the operating system was being used during the monitoring interval. Furthermore, the omission may result in billing difficulties and discrepancies.
Accordingly, there exists a need for systems and methods to determine adjustments to event logs that will facilitate analysis per their original intention, e.g., for billing, for forensic assessments, etc.
Those skilled in the art will appreciate that the logic and process steps illustrated in the various flow diagrams discussed below may be altered in a variety of ways. For example, the order of the logic may be rearranged, substeps may be performed in parallel, illustrated logic may be omitted, other logic may be included, etc. One will recognize that certain steps may be consolidated into a single step and that actions represented by a single step may be alternatively represented as a collection of substeps. The figures are designed to make the disclosed concepts more comprehensible to a human reader. Those skilled in the art will appreciate that actual data structures used to store this information may differ from the figures and/or tables shown, in that they, for example, may be organized in a different manner; may contain more or less information than shown; may be compressed and/or encrypted; etc.